docs(case-study): correct IG trace_open/exec 5.4 result (as-compiled floor vs IG runtime fallback)#42
Merged
Merged
Conversation
… runtime reach Per IG maintainer Alban Crequy, Inspektor Gadget's loader falls back from BPF ring buffers to perf buffers (and bpf_ktime_get_boot_ns -> bpf_ktime_get_ns) on kernels that lack them, so trace_open/trace_exec actually run on 5.4 — the prior "fail" was an as-compiled result, not IG's real reach. Verified empirically that this can't be replicated by a faithful loader: swapping the events ringbuf to a perf array gets past the map, but the 5.4 load then fails on bpf_ktime_get_boot_ns (call unknown#125), a helper IG rewrites and that a generic loader cannot. So the doc now frames the 5.4 row as "compiled object targets >= 5.8" and the runtime fallback as a documented limitation, not a bug to fix in bpfcompat. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Corrects the Inspektor Gadget case study's
trace_open/trace_exec5.4 result, which was presented as a clean compatibility failure but is really an as-compiled floor.Why
IG maintainer Alban Crequy confirmed IG's loader falls back from BPF ring buffers → perf buffers (and
bpf_ktime_get_boot_ns→bpf_ktime_get_ns) on kernels that lack them — so the gadgets actually run on 5.4. bpfcompat does a faithful as-compiled load, so it reports the stricter floor.Verified the fallback isn't generically replicable
Experimentally swapped the
eventsringbuf → perf-event array before load: it gets past the map, buttrace_openthen fails the 5.4 verifier onbpf_ktime_get_boot_ns(call unknown#125 → invalid func). A faithful loader can't rewrite helper calls without reimplementing IG's loader — so this is a documented limitation, not a feature to build. The doc now states that plainly.(Docs-only; no code change.)
🤖 Generated with Claude Code